Сделай лучше так
$q = urldecode(trim($_GET['q']));
$q = mysql_real_escape_string($q);
$count = mysql_result(mysql_query("SELECT COUNT(`id`) FROM `".FILES."` WHERE `name` LIKE '%".str_replace(array('%', '_'), array('\%', '\_'), $q)."%' AND `size`>'0'"), 0);
$sql = mysql_query("SELECT `id`, `path`, `name`, `load`, `size` FROM `".FILES."` WHERE `name` LIKE '%".str_replace(array('%', '_'), array('\%', '\_'), $q)."%' AND `size`>'0' LIMIT ".START.", ".$set['pagestr']);